- ‘Thousands’ of GCHQ storage devices are missing or unaccounted for
- Most are likely protected by encryption or PIN access
- Watchdog is ‘concerned’ and ‘disappointed’
The UK’s intelligence and cybersecurity agency, GCHQ, has been slammed by its very own watchdog after failing to account for thousands of missing storage devices.
The 2025 Investigatory Powers Commissioner’s Office (IPCO) report ultimately concluded GCHQ has failed to establish the location or status of thousands of removable storage devices such as USB sticks, external hard drives and memory cards.
While the exact number of devices is unconfirmed, the IPCO report does confirm the estimate to be “in the thousands” – and that’s a GCHQ estimate, not a third-party estimate.
GCHQ has seemingly lost thousands of USBs, external drives, memory cards
“There is a programme of further work to locate and account for as many of these devices as possible,” the report adds, noting that “GCHQ will be able to report how many devices have been confirmed as lost.”
Nevertheless, the IPCO expressed disappointment at how long investigations and remedial action had taken – the problems were actually first brought to the watchdog’s attention years ago, so it’s not a newly discovered issue. “We remain very concerned about this issue and are disappointed with the time it has taken GCHQ to investigate.”
The issue was already raised in the IPCO’s 2024 report, when the watchdog confirmed that it has asked GCHQ and MI5 to “review their internal allocation and audit of removable media” the year prior.
Back then, it was already acknowledged that many of the missing devices were either encrypted or required a PIN to access, however given the intense sensitivity of many of these artefacts, significant risk could still be on the cards.
The latest report acknowledged the technical and practical difficulties involve with the ongoing investigation, but calls for continued senior-level oversight.” According to the report, GCHQ has commissioned a new tool to monitor the issue.
